dsh-plugin-update-audit

Managing several DeepSeek Harness Profiles means juggling direct plugin dependencies scattered across npm registries, GitHub repositories, and even local tarballs. Telling which ones have newer releases, which upstream HEADs have drifted, and which need a human eyeball used to mean clicking through each one by hand-slow, easy to miss, and risky if an install or delete fires by accident. dsh-plugin-update-audit collapses that scramble into a single read-only inventory with zero write access.

The plugin registers one tool, plugin_update_audit, and classifies each direct dependency by its declared source. npm dependencies are checked against the official Registry latest manifest; GitHub dependencies are compared to the repository current HEAD via the GitHub API against the locally pinned immutable commit; local tarballs and directories are flagged as local_review_required with SHA-256 checksums for readable files. Unsupported, missing, or unreachable sources are reported per plugin without aborting the full audit. Every status-update_available, upstream_changed, local_review_required, current, ahead, offline, unpinned, not_installed, unavailable-is advisory; the plugin never installs, upgrades, removes, or rewrites anything.

The security posture is deliberately tight: network access is restricted to registry.npmjs.org and api.github.com, an offline mode limits the run to a local inventory, and local dependency paths are redacted from tool output. It is built for ops, security, and compliance teams who manage multiple Profiles and want a structured pre-update check: run the audit, review release notes, take a snapshot, update one plugin at a time, restart DSH, and re-run acceptance tests to keep update risk predictable.